[vts] Verify RKP VM DICE chain in IRPC VTS
This cl adds verifications to the IRPC VTS to check that:
- RKP VM DICE chains have a continuous presence of RKP VM markers
till the last DICE certificate.
- Non-RKP VM DICE chains do not have such continuous presence of
RKP VM markers.
Test: atest VtsHalRemotelyProvisionedComponentTargetTest
Test: atest libkeymint_remote_prov_support_test
Bug: 314128697
Change-Id: Ib966b4bd584f1f931b7f19b4b58a1a37b5266f5e
diff --git a/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp b/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
index f68ff91..8f918af 100644
--- a/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
+++ b/security/rkp/aidl/vts/functional/VtsRemotelyProvisionedComponentTests.cpp
@@ -55,10 +55,7 @@
constexpr uint8_t MIN_CHALLENGE_SIZE = 0;
constexpr uint8_t MAX_CHALLENGE_SIZE = 64;
-const string DEFAULT_INSTANCE_NAME =
- "android.hardware.security.keymint.IRemotelyProvisionedComponent/default";
-const string RKP_VM_INSTANCE_NAME =
- "android.hardware.security.keymint.IRemotelyProvisionedComponent/avf";
+
const string KEYMINT_STRONGBOX_INSTANCE_NAME =
"android.hardware.security.keymint.IKeyMintDevice/strongbox";
@@ -188,7 +185,7 @@
}
ASSERT_NE(provisionable_, nullptr);
auto status = provisionable_->getHardwareInfo(&rpcHardwareInfo);
- isRkpVmInstance_ = GetParam() == RKP_VM_INSTANCE_NAME;
+ isRkpVmInstance_ = GetParam() == RKPVM_INSTANCE_NAME;
if (isRkpVmInstance_) {
if (status.getExceptionCode() == EX_UNSUPPORTED_OPERATION) {
GTEST_SKIP() << "The RKP VM is not supported on this system.";
@@ -227,7 +224,7 @@
RpcHardwareInfo hwInfo;
auto status = rpc->getHardwareInfo(&hwInfo);
- if (hal == RKP_VM_INSTANCE_NAME && status.getExceptionCode() == EX_UNSUPPORTED_OPERATION) {
+ if (hal == RKPVM_INSTANCE_NAME && status.getExceptionCode() == EX_UNSUPPORTED_OPERATION) {
GTEST_SKIP() << "The RKP VM is not supported on this system.";
}
ASSERT_TRUE(status.isOk());
@@ -268,7 +265,7 @@
auto status = rpc->generateCertificateRequestV2({} /* keysToSign */, challenge, &csr);
EXPECT_TRUE(status.isOk()) << status.getDescription();
- auto result = isCsrWithProperDiceChain(csr);
+ auto result = isCsrWithProperDiceChain(csr, DEFAULT_INSTANCE_NAME);
ASSERT_TRUE(result) << result.message();
ASSERT_TRUE(*result);
}
@@ -494,7 +491,7 @@
auto result = verifyProductionProtectedData(
deviceInfo, cppbor::Array(), keysToSignMac, protectedData, testEekChain_, eekId_,
- rpcHardwareInfo.supportedEekCurve, provisionable_.get(), challenge_);
+ rpcHardwareInfo.supportedEekCurve, provisionable_.get(), GetParam(), challenge_);
ASSERT_TRUE(result) << result.message();
}
}
@@ -517,9 +514,10 @@
&protectedData, &keysToSignMac);
ASSERT_TRUE(status.isOk()) << status.getDescription();
- auto firstBcc = verifyProductionProtectedData(
- deviceInfo, /*keysToSign=*/cppbor::Array(), keysToSignMac, protectedData, testEekChain_,
- eekId_, rpcHardwareInfo.supportedEekCurve, provisionable_.get(), challenge_);
+ auto firstBcc = verifyProductionProtectedData(deviceInfo, /*keysToSign=*/cppbor::Array(),
+ keysToSignMac, protectedData, testEekChain_,
+ eekId_, rpcHardwareInfo.supportedEekCurve,
+ provisionable_.get(), GetParam(), challenge_);
ASSERT_TRUE(firstBcc) << firstBcc.message();
status = provisionable_->generateCertificateRequest(
@@ -527,9 +525,10 @@
&protectedData, &keysToSignMac);
ASSERT_TRUE(status.isOk()) << status.getDescription();
- auto secondBcc = verifyProductionProtectedData(
- deviceInfo, /*keysToSign=*/cppbor::Array(), keysToSignMac, protectedData, testEekChain_,
- eekId_, rpcHardwareInfo.supportedEekCurve, provisionable_.get(), challenge_);
+ auto secondBcc = verifyProductionProtectedData(deviceInfo, /*keysToSign=*/cppbor::Array(),
+ keysToSignMac, protectedData, testEekChain_,
+ eekId_, rpcHardwareInfo.supportedEekCurve,
+ provisionable_.get(), GetParam(), challenge_);
ASSERT_TRUE(secondBcc) << secondBcc.message();
// Verify that none of the keys in the first BCC are repeated in the second one.
@@ -579,7 +578,7 @@
auto result = verifyProductionProtectedData(
deviceInfo, cborKeysToSign_, keysToSignMac, protectedData, testEekChain_, eekId_,
- rpcHardwareInfo.supportedEekCurve, provisionable_.get(), challenge_);
+ rpcHardwareInfo.supportedEekCurve, provisionable_.get(), GetParam(), challenge_);
ASSERT_TRUE(result) << result.message();
}
}
@@ -767,8 +766,8 @@
provisionable_->generateCertificateRequestV2({} /* keysToSign */, challenge, &csr);
ASSERT_TRUE(status.isOk()) << status.getDescription();
- auto result = verifyProductionCsr(cppbor::Array(), csr, provisionable_.get(), challenge,
- isRkpVmInstance_);
+ auto result = verifyProductionCsr(cppbor::Array(), csr, provisionable_.get(), GetParam(),
+ challenge, isRkpVmInstance_);
ASSERT_TRUE(result) << result.message();
}
}
@@ -789,8 +788,8 @@
auto status = provisionable_->generateCertificateRequestV2(keysToSign_, challenge, &csr);
ASSERT_TRUE(status.isOk()) << status.getDescription();
- auto result = verifyProductionCsr(cborKeysToSign_, csr, provisionable_.get(), challenge,
- isRkpVmInstance_);
+ auto result = verifyProductionCsr(cborKeysToSign_, csr, provisionable_.get(), GetParam(),
+ challenge, isRkpVmInstance_);
ASSERT_TRUE(result) << result.message();
}
}
@@ -820,15 +819,15 @@
auto status = provisionable_->generateCertificateRequestV2(keysToSign_, challenge_, &csr);
ASSERT_TRUE(status.isOk()) << status.getDescription();
- auto firstCsr = verifyProductionCsr(cborKeysToSign_, csr, provisionable_.get(), challenge_,
- isRkpVmInstance_);
+ auto firstCsr = verifyProductionCsr(cborKeysToSign_, csr, provisionable_.get(), GetParam(),
+ challenge_, isRkpVmInstance_);
ASSERT_TRUE(firstCsr) << firstCsr.message();
status = provisionable_->generateCertificateRequestV2(keysToSign_, challenge_, &csr);
ASSERT_TRUE(status.isOk()) << status.getDescription();
- auto secondCsr = verifyProductionCsr(cborKeysToSign_, csr, provisionable_.get(), challenge_,
- isRkpVmInstance_);
+ auto secondCsr = verifyProductionCsr(cborKeysToSign_, csr, provisionable_.get(), GetParam(),
+ challenge_, isRkpVmInstance_);
ASSERT_TRUE(secondCsr) << secondCsr.message();
ASSERT_EQ(**firstCsr, **secondCsr);
@@ -846,8 +845,8 @@
auto status = provisionable_->generateCertificateRequestV2(keysToSign_, challenge_, &csr);
ASSERT_TRUE(status.isOk()) << status.getDescription();
- auto result = verifyProductionCsr(cborKeysToSign_, csr, provisionable_.get(), challenge_,
- isRkpVmInstance_);
+ auto result = verifyProductionCsr(cborKeysToSign_, csr, provisionable_.get(), GetParam(),
+ challenge_, isRkpVmInstance_);
ASSERT_TRUE(result) << result.message();
}
@@ -977,7 +976,8 @@
provisionable_->generateCertificateRequestV2({} /* keysToSign */, challenge_, &csr);
ASSERT_TRUE(irpcStatus.isOk()) << irpcStatus.getDescription();
- auto result = verifyProductionCsr(cppbor::Array(), csr, provisionable_.get(), challenge_);
+ auto result =
+ verifyProductionCsr(cppbor::Array(), csr, provisionable_.get(), GetParam(), challenge_);
ASSERT_TRUE(result) << result.message();
std::unique_ptr<cppbor::Array> csrPayload = std::move(*result);